How SPIFFE Helps Istio in Service Mesh Federation
summary
Explains a concrete solution: Istio uses the SPIFFE trust bundle (a published endpoint of x.509 roots) to exchange roots with SPIRE so two meshes can verify each other without brittle cross‑signing. Demo shows Citadel and SPIRE publish and consume bundles, mapping trust domains so service A uses mesh B’s root and vice versa. Bundle refresh is 600 seconds refresh and there is no TLS renegotiation so existing connections remain until reconnect. Includes Citadel and SPIRE integration steps and YAML config notes.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:18What is SPIFFE?
- 3:15Istio Identity Framework
- 4:10Why Service Mesh Federation Matters?
- 5:03Identity Federation Challenges
- 6:12Service Mesh and Trust Domain
- 7:18Federation of Meshes
- 8:22Federation within an Organization
- 10:20Federation across Organizations (1)
- 14:20SPIFFE Trust Bundle Example
- 16:26Federation with SPIFFE Trust Bundle (2)
related talks
30mHow SPIFFE Helps Istio in Service Mesh Federation
32mSecuring Communication Between Meshes and Beyond with SPIFFE Federation
31mBridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity
49mReal World SPIFFE Scenarios and Outcomes
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
27mBridging Trust Between Multi-Cluster Meshes
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication